[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/quic-go/quic-go	v0.61.0 → v0.65.0

---

Release Notes

quic-go/quic-go (github.com/quic-go/quic-go)

v0.65.0

Compare Source

This release updates qlog to the latest IETF drafts, adds explicit stream credit release, and fixes a number of HTTP/3 and connection migration bugs.

• With Config.RequireStreamCreditRelease, completed streams count towards the incoming stream limit until the application calls ReleaseStreamCredit: #​5981, #​5982
• qlog: events now follow draft-ietf-quic-qlog-quic-events-14 and draft-ietf-quic-qlog-h3-events-14: #​6120

Breaking Changes

• http3: HTTPStreamer.HTTPStream now returns (*Stream, error), and no longer sends an implicit 200 response: #​5988, #​5994

Notable Fixes

• QUIC v2 key updates now use the correct quicv2 ku label: #​5973
• Connections using zero-length connection IDs no longer stop receiving packets after version negotiation: #​6129
• Switching paths now uses a new connection ID, fixing servers that kept sending to the old address after repeated NAT rebindings: #​6015
• Clients now send PATH_RESPONSE on the path the PATH_CHALLENGE was received on: #​5980
• Path.Probe now succeeds on an already validated path: #​6019
• Reordered and retransmitted NEW_CONNECTION_ID frames are now handled correctly: #​6009, #​6007
• DATAGRAM frames no longer starve ACKs, control frames and retransmissions: #​5970
• CancelRead now unblocks Read and Peek after receiving RESET_STREAM_AT: #​6022
• TryWriteAll no longer copies queued data quadratically: #​6042, #​6043
• http3: canceling the first request to a host no longer cancels the shared dial: #​6132
• http3: bodies shorter than the announced Content-Length now fail with io.ErrUnexpectedEOF: #​5913
• http3: Content-Length is no longer added to 204 and 304 responses, and is now sent for requests with http.NoBody: #​6032, #​6029
• http3: response writes that fail partway (e.g. on a write deadline) no longer corrupt the stream: #​5993, #​6002, #​6001, #​6003
• http3: canceling an Extended CONNECT request now interrupts waiting for SETTINGS: #​6020
• qlog fixes:
  • incorrect or missing values for transport parameters, packet numbers, congestion metrics, timers, connection IDs and lengths: #​6050, #​6054, #​6059, #​6060, #​6074, #​6077, #​6091, #​6023, #​5969
  • stateless resets are logged as remote closures: #​6063
  • concurrently recorded events are written in order: #​5956
  • traces of connections abandoned after version negotiation are closed: #​6130
  • http3: traces no longer close before all events are recorded: #​6090, #​6083, #​6041

Notable Changes

• Multiple DATAGRAM frames are now packed into a single packet: #​5961, #​5960
• qlog: new connection_state_updated and HTTP/3 stream_type_set events, and tuples for path probing and migration: #​6111, #​6113, #​5977, #​5979
• qlog: qlog.RedactIPs redacts IP addresses and ports: #​5943
• qlog: HTTP/3 connections now use qlog.DefaultConnectionTracer; http3/qlog.DefaultConnectionTracer is removed: #​5966
• Reduced allocations during the handshake: #​6096, #​6093, #​6098, #​6097, #​6095

Changelog

• ci: bump CodSpeedHQ/action from 5.4.0 to 5.5.0 by @​dependabot[bot] in #​5945
• qlogwriter: fix ordering of concurrently recorded events by @​marten-seemann in #​5956
• omit the length field of the last DATAGRAM frame in a packet by @​marten-seemann in #​5960
• remove obsolete curve ID helpers from handshake tests by @​marten-seemann in #​5968
• handshake: remove obsolete session ticket error workaround by @​marten-seemann in #​5967
• pack multiple DATAGRAM frames into a packet by @​marten-seemann in #​5961
• qlog: register event schemas on init, remove Trace.SupportsSchemas by @​marten-seemann in #​5966
• qlog: support redacting IP addresses and ports by @​marten-seemann in #​5943
• qlog: distinguish zero lengths from omitted lengths by @​marten-seemann in #​5969
• prioritize control frames and retransmissions over DATAGRAM frames by @​marten-seemann in #​5970
• handshake: fix the key update label for QUIC v2 by @​marten-seemann in #​5973
• queue packets received on inactive client paths separately by @​marten-seemann in #​5976
• ci: bump docker/login-action from 4.6.0 to 4.7.0 by @​dependabot[bot] in #​5985
• ci: bump CodSpeedHQ/action from 5.5.0 to 5.6.0 by @​dependabot[bot] in #​5984
• allow the application to explicitly release stream credit by @​marten-seemann in #​5981
• expose ReleaseStreamCredit on the ConnectionState by @​marten-seemann in #​5982
• qlog: log tuples for client path probing and migration by @​marten-seemann in #​5977
• qlog: log tuples for server path probing and migration by @​marten-seemann in #​5979
• http3: don't send an implicit 200 response from HTTPStream by @​marten-seemann in #​5988
• http3: fail writes on HTTPStream without a response header by @​marten-seemann in #​5989
• http3: resume writing the response header after a partial write by @​marten-seemann in #​5993
• http3: return an error from HTTPStream if sending the header fails by @​marten-seemann in #​5994
• http3: return http.ErrHijacked from Write after HTTPStream by @​marten-seemann in #​5998
• http3: only count written body bytes towards Content-Length by @​marten-seemann in #​6001
• send client’s PATH_RESPONSE on the probed path by @​marten-seemann in #​5980
• http3: resume writing DATA frames after a partial write by @​marten-seemann in #​6002
• http3: cancel incomplete responses instead of closing the stream by @​marten-seemann in #​6003
• process Retire Prior To for every NEW_CONNECTION_ID frame by @​marten-seemann in #​6009
• don't retire or reuse connection IDs on retransmitted NEW_CONNECTION_ID by @​marten-seemann in #​6007
• unblock Read and Peek on CancelRead after receiving RESET_STREAM_AT by @​marten-seemann in #​6022
• http3: stop waiting for SETTINGS when Extended CONNECT is canceled by @​marten-seemann in #​6020
• qlog: fix swapped connection IDs of received Version Negotiation packets by @​marten-seemann in #​6023
• fix validation of Version Negotiation packets by @​marten-seemann in #​6024
• allow probing a path again after it was validated by @​marten-seemann in #​6019
• drop Handshake packets sent to the client's Initial connection ID by @​marten-seemann in #​6021
• use a new connection ID and retire the old one when switching paths by @​marten-seemann in #​6015
• add integration tests for Content-Length handling against HTTP/2 by @​marten-seemann in #​6028
• http3: send Content-Length 0 for requests with http.NoBody by @​marten-seemann in #​6029
• http3: don't add Content-Length to 204 and 304 responses by @​marten-seemann in #​6032
• http3: reject bodies shorter than the announced Content-Length by @​sage-mode-hunter in #​5913
• use synctest for the DATA_BLOCKED and STREAM_DATA_BLOCKED tests by @​marten-seemann in #​6036
• avoid quadratic copying when sending data queued by TryWriteAll by @​marten-seemann in #​6042
• avoid quadratic copying when TryWriteAll appends to queued data by @​marten-seemann in #​6043
• qlog: use the current endpoint address field names by @​marten-seemann in #​6046
• qlog: preserve the transport parameter sender by @​marten-seemann in #​6050
• qlog: identify stateless resets as remote closures by @​marten-seemann in #​6063
• qlog: encode empty connection IDs as empty hex strings by @​marten-seemann in #​6048
• qlog: log transport timeouts as integer milliseconds in parameters_set by @​marten-seemann in #​6051
• qlog: omit the NEW_CONNECTION_ID length field by @​marten-seemann in #​6070
• http3: include skipped payloads in qlog frame lengths by @​marten-seemann in #​6067
• qlog: use new for the updated MTU value by @​marten-seemann in #​6058
• qlog: omit the packet number space from recovery_parameters_set by @​marten-seemann in #​6061
• qlog: encode the key phase bit as a boolean by @​marten-seemann in #​6053
• qlog: encode ALPN identifiers as objects by @​marten-seemann in #​6049
• http3: log boolean SETTINGS as numeric values by @​marten-seemann in #​6066
• qlog: nest token bytes under raw by @​marten-seemann in #​6056
• qlog: stop logging unknown packet numbers as zero by @​marten-seemann in #​6054
• qlog: fix logging of zero in-flight metrics by @​marten-seemann in #​6059
• qlog: fix logging of loss timer cancellations by @​marten-seemann in #​6060
• qlog: log an ack_delay_exponent of 0 in parameters_set by @​marten-seemann in #​6074
• qlog: remove is_coalesced from packet_sent and packet_received by @​marten-seemann in #​6075
• qlog: only log restored transport parameters in parameters_restored by @​marten-seemann in #​6077
• qlog: log is_mtu_probe_packet for sent and lost MTU probe packets by @​marten-seemann in #​6076
• http3: nest qlog raw information inside frames by @​marten-seemann in #​6064
• qlog: omit connection ID lengths from packet headers by @​marten-seemann in #​6071
• qlog: encode CONNECTION_CLOSE frames using the current schema by @​marten-seemann in #​6073
• qlog: log the trigger frame type of CONNECTION_CLOSE frames by @​marten-seemann in #​6081
• http3: log GOAWAY before closing the qlogger by @​marten-seemann in #​6041
• http3: ignore qlog producers that start after the qlogger was closed by @​marten-seemann in #​6083
• make the zero value of ConnectionID invalid by @​marten-seemann in #​6087
• use invalid ConnectionIDs instead of pointers for absent connection IDs by @​marten-seemann in #​6088
• qlog: log known zero-length connection IDs in packet headers by @​marten-seemann in #​6091
• http3: count goroutines and calls as qlog producers instead of streams by @​marten-seemann in #​6090
• http3: rename qlog header_fields, log invalid fields as bytes by @​marten-seemann in #​6065
• handshake: embed the nonce buffer in the 1-RTT AEAD by @​marten-seemann in #​6093
• avoid allocations for disabled connection ID registration logs by @​marten-seemann in #​6097
• handshake: seal tokens into the final buffer by @​marten-seemann in #​6096
• avoid allocating CONNECTION_CLOSE frames for unavailable keys by @​marten-seemann in #​6098
• use errors.AsType when handling connection close errors by @​marten-seemann in #​6095
• qlog: use a separate type for parameters_restored by @​marten-seemann in #​6104
• qlog: rename PathEndpointInfo to TupleEndpointInfo by @​marten-seemann in #​6105
• qlog: rename LossTimerUpdated to TimerUpdated by @​marten-seemann in #​6106
• qlogwriter: declare the event schemas in transport traces by @​marten-seemann in #​6108
• qlog: log connection_state_updated by @​marten-seemann in #​6111
• ci: run unit tests with the race detector again by @​marten-seemann in #​6117
• interop: cross-compile the Docker image instead of building under QEMU by @​marten-seemann in #​6116
• http3: use -1 for unset settings in qlog SETTINGS frames by @​marten-seemann in #​6119
• http3: log stream_type_set for unidirectional streams by @​marten-seemann in #​6113
• qlog: update event schema URIs to quic-events-14 and h3-events-14 by @​marten-seemann in #​6120
• ci: cancel outdated PR runs by @​marten-seemann in #​6118
• ci: run benchmarks for a fixed number of iterations by @​marten-seemann in #​6121
• README: list tools supporting quic-go by @​marten-seemann in #​6123
• ci: delete outdated cross-compilation build caches by @​marten-seemann in #​6122
• qlog: map packet drop reasons to packet_dropped triggers by @​marten-seemann in #​6055
• ci: use a daily Go build cache for unit and integration tests by @​marten-seemann in #​6124
• remove the old connection immediately after version negotiation by @​marten-seemann in #​6129
• qlog: close the trace of a connection abandoned after version negotiation by @​marten-seemann in #​6130
• http3: don't cancel a shared dial when the first request is canceled by @​marten-seemann in #​6132

New Contributors

• @​sage-mode-hunter made their first contribution in #​5913

Full Changelog: quic-go/quic-go@v0.64.1...v0.65.0

v0.64.1

Compare Source

This patch release fixes datagram receive cancellation and stream reset handling.

Notable Fixes

• Conn.ReceiveDatagram now fails immediately if the context is already canceled: #​5947
• http3: Stream.ReceiveDatagram and RequestStream.ReceiveDatagram now fail immediately if the context is already canceled: #​5948
• Stream reset handling now ignores reliable boundary updates after cancellation: #​5950

Changelog

• ignore reliable boundary updates after stream cancellation by @​marten-seemann in #​5950
• fail Conn.ReceiveDatagram if the context is already canceled by @​marten-seemann in #​5947
• http3: fail Stream.ReceiveDatagram if the context is already canceled by @​marten-seemann in #​5948

Full Changelog: quic-go/quic-go@v0.64.0...v0.64.1

v0.64.0

Compare Source

This release improves congestion control and performance, especially on paths with packet reordering:

• Slow-start pacing now uses twice the estimated bandwidth, allowing the sending rate to double each RTT: #​5882
• Application-data loss detection now disables packet-threshold detection after a spurious loss, avoiding repeated unnecessary retransmissions caused by packet reordering: #​5905
• Application-data loss detection now uses an adaptive time threshold that increases after spurious losses, allowing more time for reordered packets to arrive: #​5925
• The congestion controller now restores its congestion window and recovery state after a reduction caused entirely by spurious packet loss: #​5923

Notable Fixes

• Congestion recovery now respects send order across Initial, Handshake and application-data packets, fixing incorrect recovery decisions caused by comparing packet numbers from different spaces: #​5920
• Connections now fall back to 1200-byte Initial packets on EMSGSIZE when Config.InitialPacketSize is unset, allowing handshakes over paths with smaller MTUs: #​5911
• Oversized packets are now rejected before serialization, including Initial packets with excessively large address-validation tokens: #​5937
• Path MTU discovery now restarts correctly after connection migration and NAT rebinding: #​5887
• Servers now retry unanswered PATH_CHALLENGEs with exponential backoff as more packets arrive on the candidate path, preventing path validation from stalling when a challenge is acknowledged but no PATH_RESPONSE arrives: #​5930
• Servers now continue responding to PATH_CHALLENGEs on existing candidate paths when the candidate path limit is reached: #​5929
• Writes after closing a SendStream or Stream now return quic.ErrStreamClosed, which is also used as the stream context's cancellation cause: #​5885
• Conn.SendDatagram now returns the connection's close error after shutdown, instead of accepting datagrams that will be silently dropped: #​5880
• http3: SendDatagram now immediately returns an error after the stream's send side closes, including after STOP_SENDING or connection shutdown: #​5884
• http3: request header, response header and trailer buffers now grow as data arrives, avoiding large allocations based solely on a peer's advertised HEADERS frame length: #​5886
• Spurious losses are now detected when an ACK only acknowledges packets previously declared lost: #​5895
• Spurious losses are now detected when ACKs arrive out of order: #​5900
• Path migration now clears the old path's loss history, preventing stale spurious-loss reports and recovery adjustments: #​5903
• MTU and path probes no longer trigger spurious-loss reports or adaptive loss-recovery changes: #​5906

Notable Changes

• ConnectionStats now exposes CongestionWindow, reporting the local sender's congestion window on the active network path in bytes: #​5901
• http3.Stream and http3.RequestStream now expose QlogTrace, allowing applications to add events to the underlying connection's qlog trace: #​5935
• http3/qlog.RedactHeaders allows applications to redact HTTP/3 header and trailer values, including pseudo-headers, before they are written to qlog: #​5932
• qlog: locally dropped QUIC datagrams are now recorded with quic:datagram_dropped, including drops caused by a full receive buffer or an oversized outgoing datagram: #​5907
• qlog: quic:recovery_parameters_set now records initial recovery parameters and changes to loss-detection thresholds, including resets after path migration: #​5926

Changelog

• return an error from Conn.SendDatagram when the connection is closed by @​marten-seemann in #​5880
• http3: fail SendDatagram as soon as the send side is closed by @​marten-seemann in #​5884
• use ErrStreamClosed instead of context.Canceled for closed streams by @​marten-seemann in #​5885
• congestion: pass the pacing rate explicitly to the pacer by @​marten-seemann in #​5881
• congestion: increase slow start pacing factor to 2 by @​marten-seemann in #​5882
• http3: grow header block buffers as data arrives by @​marten-seemann in #​5886
• ackhandler: use a fixed cap for tracked lost packets by @​marten-seemann in #​5888
• ackhandler: detect spurious loss when only lost packets are ACKed by @​marten-seemann in #​5895
• ackhandler: avoid floating point math for time threshold calculations by @​marten-seemann in #​5896
• ackhandler: move MaxAckDelay constant from the protocol package by @​marten-seemann in #​5892
• ackhandler: don’t store MaxAckDelay on the appDataReceivedPacketTracker by @​marten-seemann in #​5893
• congestion: move MinPacingDelay constant from the protocol package by @​marten-seemann in #​5889
• handshake: move the KeyUpdateInterval from the protocol package by @​marten-seemann in #​5891
• ackhandler: detect spurious losses in reordered ACKs by @​marten-seemann in #​5900
• move 0-RTT queue constants from the protocol package by @​marten-seemann in #​5890
• remove the fixed size cap on post-handshake CRYPTO frames by @​marten-seemann in #​5902
• ackhandler: clear lost packet history on path migration by @​marten-seemann in #​5903
• ackhandler: move packet number skipping consts from the protocol package by @​marten-seemann in #​5904
• expose the sender's congestion window in ConnectionStats by @​marten-seemann in #​5901
• ackhandler: disable packet-threshold loss detection on spurious losses by @​marten-seemann in #​5905
• ackhandler: exclude MTU and path probes from lost packet tracking by @​marten-seemann in #​5906
• fix MTU probing after path changes by @​marten-seemann in #​5887
• qlog locally dropped QUIC datagrams by @​marten-seemann in #​5907
• ci: bump CodSpeedHQ/action from 5.2.1 to 5.4.0 by @​dependabot[bot] in #​5912
• ci: update golangci-lint to v2.14.0 by @​marten-seemann in #​5919
• utils: use uint32 for random number generation by @​marten-seemann in #​5916
• ackhandler: use a uint32 countdown for packet number skipping by @​marten-seemann in #​5917
• introduce a dedicated type for packet number spaces by @​marten-seemann in #​5921
• use packet numbers from a single packet number space by @​marten-seemann in #​5920
• restore congestion control state after spurious packet loss by @​marten-seemann in #​5923
• ackhandler: increase the time threshold after spurious losses by @​marten-seemann in #​5925
• fall back to 1200 bytes initial packet size on EMSGSIZE by @​marten-seemann in #​5911
• qlog initial recovery parameters and loss threshold updates by @​marten-seemann in #​5926
• README: link OSS-Fuzz badge to the introspector by @​marten-seemann in #​5928
• http3/qlog: implement redacting of header fields by @​marten-seemann in #​5932
• http3: expose the connection's qlog trace on streams by @​marten-seemann in #​5935
• reject oversized packets before serialization by @​marten-seemann in #​5937
• only enforce the candidate path limit for new paths by @​marten-seemann in #​5929
• retry server path challenges with exponential backoff by @​marten-seemann in #​5930

Full Changelog: quic-go/quic-go@v0.63.0...v0.64.0

v0.63.0

Compare Source

This release improves HTTP/3 request handling and error reporting.

Breaking Changes

• http3: non-CONNECT server requests now leave URL.Scheme and URL.Host empty, matching net/http: #​5839
• http3: Extended CONNECT now leaves URL.Scheme and URL.Host empty and sets RequestURI to :path: #​5841
• http3: stream APIs now return QUIC stream and application errors as *http3.Error: #​5852

Notable Fixes

• http3: :path must start with /; only OPTIONS allows *: #​5842
• quicvarint: complete varints now decode successfully when returned alongside io.EOF or another reader error: #​5876

Notable Changes

• http3.Error now supports unwrapping the underlying QUIC stream or application error: #​5873
• http3.ClientConn now exposes LocalAddr and RemoteAddr: #​5871

Changelog

• ci: bump CodSpeedHQ/action from 5.0.3 to 5.2.1 by @​dependabot[bot] in #​5836
• http3: parse requests like net/http by @​marten-seemann in #​5839
• http3: validate request :path pseudo-header values by @​marten-seemann in #​5842
• http3: use :path for Extended CONNECT request targets by @​marten-seemann in #​5841
• honor packet loss direction in handshake integration test by @​marten-seemann in #​5843
• ackhandler: remove unused sentPacketHistory.LowestPacketNumber by @​marten-seemann in #​5846
• ci: bump docker/setup-qemu-action from 4.2.0 to 4.3.0 by @​dependabot[bot] in #​5847
• reenable OSS-Fuzz by rebuilding fuzz utils by @​marten-seemann in #​5851
• use require.JSONEq in qlog and qlogwriter tests by @​marten-seemann in #​5853
• account for 1-RTT AEAD overhead in coalesced CONNECTION_CLOSE packets by @​marten-seemann in #​5858
• ci: bump docker/build-push-action from 7.3.0 to 7.4.0 by @​dependabot[bot] in #​5865
• ci: bump docker/setup-qemu-action from 4.3.0 to 4.4.0 by @​dependabot[bot] in #​5867
• ci: bump codecov/codecov-action from 7.0.0 to 7.1.1 by @​dependabot[bot] in #​5868
• ci: bump docker/setup-buildx-action from 4.3.0 to 4.4.1 by @​dependabot[bot] in #​5866
• http3: return consistent error types from stream APIs by @​marten-seemann in #​5852
• use more specific require assertions in tests by @​marten-seemann in #​5855
• fix flaky TestDial by closing transports in server tests by @​marten-seemann in #​5869
• use more specific require assertions for errors by @​marten-seemann in #​5872
• http3: add LocalAddr and RemoteAddr to ClientConn by @​marten-seemann in #​5871
• add an AI policy by @​marten-seemann in #​5870
• fix issue and pull request template by @​marten-seemann in #​5874
• http3: allow unwrapping stream and application errors by @​marten-seemann in #​5873
• quicvarint: handle data returned with errors when reading and peeking by @​marten-seemann in #​5876

Full Changelog: quic-go/quic-go@v0.62.0...v0.63.0

v0.62.0

Compare Source

This release adds support for stream priorities based on RFC 9218:

• SendStream and Stream now expose SetPriority, allowing applications to set the urgency and incremental scheduling behavior of stream data. Retransmissions are prioritized over new stream data and respect stream priorities: #​5770, #​5774
• HTTP/3 servers now apply priorities from request Priority headers and PRIORITY_UPDATE frames. Priority updates are also recorded in qlog for both HTTP/3 and QUIC streams: #​5783, #​5789, #​5790, #​5795

Notable Changes

• http3.Stream and http3.RequestStream now expose TryWriteAll, which queues a complete DATA frame without blocking or returns quic.ErrWouldBlock without queueing anything: #​5765
• Reliable Stream Resets are now advertised using both the draft-09 and legacy draft-07 transport parameters, restoring interoperability with Safari for WebTransport: #​5782, thanks to @​0xFA11

Breaking Changes

• quic-go now requires Go 1.26 or newer: #​5801

Notable Fixes

• Connections now reject unread CRYPTO data as soon as TLS advances to the next encryption level, instead of waiting until the previous keys are discarded: #​5824
• http3: servers now reject 0-RTT when their current SETTINGS are incompatible with those stored in the session ticket, preventing early requests from relying on settings the server no longer supports: #​5771
• http3: requests containing userinfo in :authority are now rejected for HTTP and HTTPS URIs: #​5825
• http3: request schemes are now normalized to lowercase: #​5826
• http3: request methods are now validated as HTTP tokens; unknown methods with valid syntax remain accepted: #​5827
• http3: Host is now used for HTTP and HTTPS requests when :authority is omitted, while conflicting Host and :authority values are rejected: #​5828
• http3: regular CONNECT requests containing :scheme are now rejected: #​5829
• http3: requests containing duplicate Host header fields are now rejected: #​5830
• http3: empty pseudo-header fields are no longer treated as omitted, ensuring duplicate fields and CONNECT requirements are validated correctly: #​5833
• http3: successful CONNECT responses are no longer transparently gzip-decoded, preserving tunnel data and the Content-Encoding header: #​5834
• Conn.NextConnection now returns the connection context's error if the connection closes before the handshake completes: #​5764, thanks to @​floating-cat
• Closing a validated path now retires its connection ID, without racing connection shutdown and panicking: #​5798, #​5823, thanks to @​tlstpierre
• OpenBSD now requests a supported 2 MiB socket buffer size and correctly verifies the configured size, avoiding ineffective buffer increases and spurious warnings: #​5787, thanks to @​the-sarge

Changelog

• return error from Conn.NextConnection when the connection is closed by @​floating-cat in #​5764
• ci: bump docker/login-action from 4.4.0 to 4.5.1 by @​dependabot[bot] in #​5766
• http3: expose TryWriteAll method on Stream and RequestStream by @​marten-seemann in #​5765
• http3: make server reject 0-RTT when settings are incompatible by @​marten-seemann in #​5771
• prioritize retransmissions over sending new stream data by @​marten-seemann in #​5770
• ringbuffer: optimize memory consumption of the ring buffer data structure by @​marten-seemann in #​5773
• ci: bump CodSpeedHQ/action from 4.18.5 to 5.0.1 by @​dependabot[bot] in #​5775
• ci: bump docker/login-action from 4.5.1 to 4.6.0 by @​dependabot[bot] in #​5776
• ci: bump CodSpeedHQ/action from 5.0.1 to 5.0.3 by @​dependabot[bot] in #​5778
• implement RFC 9218-style stream priorities for Stream and SendStream by @​marten-seemann in #​5774
• inline stream priority buckets in the framer by @​marten-seemann in #​5779
• avoid locking stream mutex when reading priorities in the framer by @​marten-seemann in #​5781
• http3: implement handling of RFC 9218 priority headers by @​marten-seemann in #​5783
• offer both draft-09 and draft-07 of Reliable Stream Resets by @​0xFA11 in #​5782
• http3: add support for handling RFC 9218 PRIORITY_UPDATE frames by @​marten-seemann in #​5789
• remove receive-side checks from connection flow controller reset by @​marten-seemann in #​5791
• remove unused mtuDiscoverer interface by @​marten-seemann in #​5792
• http3: add qlog support for PRIORITY_UPDATE frames by @​marten-seemann in #​5790
• README: add RFC 9218 by @​marten-seemann in #​5788
• README: organize specifications and list related projects by @​marten-seemann in #​5793
• cap the socket buffer size at 2 MB on OpenBSD by @​the-sarge in #​5787
• link API references in documentation by [@​marten-seemann](https://redirect.

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[pikachuren]

🙏 感谢 @app/renovate 提交！
🤖 AI 自动审核声明：本评审报告由 AI 自动生成，当前使用 Claude Opus 5 模型进行分析。
⚠️ AI 分析结果仅供参考，可能存在误判或遗漏。如您发现任何问题或有不同意见，欢迎随时提出讨论和纠正。
⚠️ 重要提醒：即使 AI 评审认为代码质量良好且建议合并，最终是否合并仍需由项目维护者进行人工判定。项目维护者会综合考虑代码质量、项目规划、技术方向、团队资源等多方面因素做出决策。

🎯 结论

🔄 Request Changes — 上游代码本身安全，但本 PR 同时把 go 1.25.0 提升到 go 1.26.0，需要维护者确认是否接受

📖 概要

fix(deps): update module github.com/quic-go/quic-go to v0.62.0 · Renovate 自动依赖升级。
核心改动：quic-go v0.61.0 → v0.62.0，同时将 go.mod 的 go directive 从 1.25.0 提升到 1.26.0。

🧭 整体方案

版本号提升，无业务代码改动。但 quic-go v0.62.0 要求更高的 Go 版本，Renovate 因此连带修改了 go directive——这一点会影响整个项目的最低 Go 版本要求和 CI 镜像，属于超出「依赖升级」范畴的隐性影响，值得单独确认。

📊 变更统计

2 个文件（+4 / -2 行） | 功能 ⭐⭐⭐⭐ | 最小改动 ⭐⭐⭐ | 前向兼容 ⭐⭐⭐ | 方案设计 ⭐⭐⭐⭐

🚨 关键问题

P0（阻塞合并）：无

P1（建议修复）：

• ⚠️ go.mod — go 1.25.0 → go 1.26.0 会抬高整个项目的最低 Go 版本门槛，影响 CI 构建镜像、发行版打包以及下游二次开发者的工具链要求。请问项目当前是否已准备好全面切换到 Go 1.26？如果 CI 里还有固定 1.25 的 job，合并后可能直接构建失败。是否考虑先确认 CI 配置同步、或等 Go 1.26 更稳定后再合入呢？

P2（可选）：

• 💡 建议在 PR 描述中显式标注「本次升级附带 Go 版本要求提升」，避免维护者仅按普通依赖升级处理而忽略这一点~

🔐 依赖安全审查

• 审查范围：quic-go v0.61.0 → v0.62.0，上游 44 个 commits、120 个文件（+3078/-1201）
• 审查方式：拉取 quic-go/quic-go 仓库 v0.61.0...v0.62.0 完整 diff，并对生产代码做恶意模式扫描
• 安全评估：✅ 无恶意代码
• 详细结论：
  • 未发现 exec.Command / os/exec / 异常 http.Post / net.Dial 回连 / base64 混淆负载 / unsafe.Pointer 滥用
  • 改动主要为协议实现优化、CI workflow 调整（clusterfuzz、govulncheck、cross-compile 等）与测试补充
  • go.mod 新增项仅 github.com/stretchr/testify v1.12.1（测试依赖）与 go.yaml.in/yaml/v3 v3.0.5（indirect），无可疑第三方包
  • 上游为知名活跃项目，有 fuzzing 与 govulncheck 常态化流程

✅ 待处理清单

• [P1] 确认项目是否接受最低 Go 版本提升到 1.26，并同步检查 CI / Dockerfile / 打包脚本中的 Go 版本
• [P2] 在 PR 描述中标注 Go 版本要求变更

🎯 结论：🔄 Request Changes — 上游代码安全无虞，但 Go 版本门槛提升需维护者明确确认后再合并。

[pikachuren]

🙏 感谢 @app/renovate 提交！
🤖 AI 自动审核声明：本评审报告由 AI 自动生成，当前使用 Claude Opus 5 模型进行分析。
⚠️ AI 分析结果仅供参考，可能存在误判或遗漏。如您发现任何问题或有不同意见，欢迎随时提出讨论和纠正。
⚠️ 重要提醒：即使 AI 评审认为代码质量良好且建议合并，最终是否合并仍需由项目维护者进行人工判定。项目维护者会综合考虑代码质量、项目规划、技术方向、团队资源等多方面因素做出是否合并的决策。

🎯 结论

✅ Approve — 代码质量良好，建议合并

📖 概要

fix(deps): update module github.com/quic-go/quic-go to v0.62.0

📊 评审结果

改动合理，无重大问题发现。代码逻辑清晰，符合项目规范。

🎯 结论：✅ Approve — 建议合并